Overview

overview

7

Static

static

5

2026-10-25...er.exe

windows10-2004-x64

7

2026-10-25...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/10/2026, 14:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
  • Size 917KB
  • Sample261026-rbbm6ss18m
  • SHA256 509bd3d68551ef3ab9617e4211b61396f78bce7b7c1faaaae847a1abd8eec310
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdbd8410a82a435d64750c0f69707ccd_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4712

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 e137429ee98023b3af6f0b953ddfc400509f7a0fdf1877988d204d6b9c2ef347
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 34804bcbab729ba676a250053f49c4ae4329157ac0d51e247d66c105869849ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 998KB
        • SHA256 ee122e82ec88eef7dfd3c673984cafb6bdac7abafbb388cd459524d32edf981b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 9a7400ecd25b78e955f2adfa45078f488fee47a8120fd8a1fdc75bbbd1c704f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 6bf1f11413c8d8f0351a659c64378d374164ed0d9a8438f4591fd171b5d7f09e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 590b6848608955b1c06c05477194d9e8a579449ac1b686b2dfc0e4e639510fcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 6aeb53392d484830a2af0802f164559d66fdcea4374b3ac5f53ddb71d4eb11c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 f16a0f3f7fe416798a1ca8888ecd9740261de527d53ef52dd5f47c61a7814aff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 779KB
        • SHA256 c58e1348c2f8316a4eca53260ee05c7171e588544b5917c3b3495e31ee43b2a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 210f921956a7b5bf100eb70cd2675a892aaf0e1dcbeb1853d61792d98012c412
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 0f2b412d142176f1830629fe8adae99e7b4ee98f22769da90697f2af801950fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 832KB
        • SHA256 a217365ed08c33ac7d2478c42d25490ac650cdd575eee36276f11330b6c825f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 792KB
        • SHA256 4de9d47c55229d66061c2b1b99209ab82fe31aaab03ad19e3f1218fd8a705c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 1d09226b31645d5f4c3265500d921739a663b81356259d21db6e1fd4b0526982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1000KB
        • SHA256 bc0b16056a95eaa9ea797bf3db9195944f4ee246b81a2cbd6d54aa849bafe3a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 cec0b5cab0b1c26d19c0bbdc66ba57464ae9dfa84454a85bfa769c8ca6040b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 72db72af37d33935edac68bf7c1ede1148463906b5b8783bd04725fa72cda568
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 86fde41f7c51bc9e953356aec81b0bbe88801858ac73861de2416c2885d2c6be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 7fb4528e942fb3bc7cb13186da597ae5cd32f7c4adecb6d1367dbeeaf74a8b9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 dcced309f14fe8084b721e41e10c2b451fa675a58801b11dc59063e9e32d0409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 94ddd7577802fb6c4b3a80e77113c0d41fcb5e93516cfb7e3b9f4550c24e947e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 948KB
        • SHA256 66c15af486c85305e3f4b557640d30a583c8105d6644b3e54d681d9aeef3fcbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 932KB
        • SHA256 57fc5dc56cba50b66032e549f4f57747591be246ad53552684c4f0bceb7da458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 940KB
        • SHA256 437f7bb3111d47921ba94e415f7bbbce7b6c8ba2d297fd075e755f8454e3a176
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 800KB
        • SHA256 239131d3b45a6ba2913106dd7262592628d7311e87e03f0effa2b4d02461c331
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 91e550e449930784fd9400be7b1b7af7b2df9e9ae2838c9ec78ae83241cb1847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 960KB
        • SHA256 aaebeb70dad746f25abf0ad60064b54dd99178372be73b501e20dfde5c2eb2a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 0daa923d498634169d7232ae04930390820326884c4fb0e2fd1755d7cf1e918f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4712-13-0x0000000000F00000-0x0000000001041000-memory.dmp
        Download

        memory/4712-0-0x0000000000F00000-0x0000000001041000-memory.dmp
        Download

        memory/4712-6-0x0000000002910000-0x0000000002995000-memory.dmp
        Download

        memory/4712-7-0x0000000002910000-0x0000000002995000-memory.dmp
        Download

        memory/4712-1-0x0000000002910000-0x0000000002995000-memory.dmp
        Download